CVE-2017-14267

High

Published: 11/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

EE 4GEE WiFi MBB devices (before version EE60_00_05.00_31) have a CSRF vulnerability related to the goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings functions.

Risk Assessment

An attacker could exploit this vulnerability to gain unauthorized access to the device settings, potentially leading to serious security breaches.

Recommendation

It is recommended to update the devices to the latest firmware version to mitigate this vulnerability and implement additional protections against CSRF attacks.

Other vulnerabilities in EE 4GEE WiFi MBB devices

CVE-2017-14269Critical
EE 4GEE WiFi MBB devices (before version EE60_00_05.00_31) allow remote attackers to obtain sensitive information via a JSONP endpoint, potentially exposing passwords and SMS content.

Original NVD description (English source)

EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and goform/uploadBackupSettings.